FINDING RATIONAL POINTS ON ELLIPTIC CURVES 
USING 6-DESCENT AND 12-DESCENT 



TOM FISHER 

Abstract. We explain how recent work on 3-descent and 4-descent 
for elliptic curves over Q can be combined to search for generators 
of the Mordell-Weil group of large height. As an application we 
show that every elliptic curve of prime conductor in the Stein- 
Watkins database has rank at least as large as predicted by the 
conjecture of Birch and Swinnerton-Dyer. 



1. Introduction 

Let E be an elliptic curve over Q. An n-descent calculation on E 
provides us with n-covering curves tt^ '■ Ca —* E for a running over a 
finite indexing set A, with the property that 



The usual choice of indexing set A is the n-Selmer group S^'^\E/Q) 
which sits in a short exact sequence 

^ E{Q)/nE{Q) ^ S^'^\E/Q) m{E/Q)[n] 0. 

Given a e S^"'\E/Q) there are two possibilities: either 7ra{Ca{Q)) is a 
coset of nE{Q) in E{Q), in which case a is the image of this coset by 
S, or Cq,(Q) is empty, in which case a maps to a non-trivial element of 
the Tate-Shafarevich group III(£'/Q). 

It has long been known that n-descent can help in the search for gen- 
erators of the Mordell-Weil group E{Q). Indeed the theory of heights 
(see for example [12]) suggests that if we write our n-coverings as curves 
of degree n with small coefficients, then a point of (logarithmic) height 
h on E{Q) should come from a point of height approximately h/{2n) 
on Ca{Q) for suitable a. This is not a precise statement (the height is 
only bounded up to the addition of a constant whose behaviour with 
respect to n is unknown) but the idea seems to work well in practice. 

We would therefore like to perform n-descent calculations for n as 
large as possible. Until recently n-descent has only been practical for 
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general^ elliptic curves in the case n = 2. Methods for 4-descent and 
8-descent have been developed in the PhD theses of Siksek [18], Wom- 
ack [24] and Stamminger [20] . Joint work of the author with Cremona, 
O'Neil, Simon and Stoll [5] has now made 3-descent practical, and in a 
few preliminary examples also 5-descent. The algorithms for 2-descent, 
3-descent and 4-descent have been contributed to the computer algebra 
system Magma [15]. 

The natural question therefore arises as to how we can combine an 
m-covering and n-covering for m and n coprime to give an mn-covering. 
At the level of abelian groups it is trivial that 

5(™")(^/Q)^5('")(£;/Q) X 5(")(S/Q). 

However, if we arc to represent the Selmer group elements as covering 
curves, then it is not so clear how one should proceed. 

Suppose we are given an m-covering '■ Cm E and an n-covering 
TTn : Cn ^ E . Then the curves Cm and C„ are torsors under E, and an 
mn-covering is given by 

^ Cm X Cn 

where we quotient out by the diagonal action of E. An alternative 
would be to take fibre product 

Cmn — Cm C^i 

with respect to the covering maps tt^ and 7r„. As far as we can see, 
neither of these constructions is suitable for practical computation. We 
have therefore taken a different approach based on representations of 
the Heisenberg group. 

Unfortunately our approach does not work for arbitrary coprime in- 
tegers m and n, but only when each of m and n is plus or minus a 
square modulo the other. This includes the case of consecutive inte- 
gers. In this case, we specify an embedding of E in P(Matn,n+i) as 
a curve of degree n{n + 1), in such a way that when E acts on itself 
by translation, the n-torsion points act as left multiplication by n x n 
matrices, and the {n -\- l)-torsion points act as right multiplication by 
(n -|- 1) X (n -t- 1) matrices. We can then twist £^ by a pair of cocycles 
taking values in E[n\ and E[n + 1] to obtain the required n{n + 1)- 
covering C„(„+i) as a curve in P(Mat„^„+i). Moreover, it turns out that 
the covering map Cn(n+i) C'n+i is defined by the n x n minors. 



i.e. we make no assumption on the Galois module structure of E[n]. 
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We give a precise statement of these results in §2. We employ two 
different methods of proof. The first, described in §3, uses representa- 
tions of the Hciscnbcrg group, and leads to results for arbitrary n. The 
second, described in §§4,5, uses the invariant theory of binary quartics 
and ternary cubics, and gives practical formulae specific to 6-descent 
and 12-descent. 

In §6 wc give some details of our implementation of 6-dcsccnt and 
12-descent in Magma. Using 12-descent, we now expect to be able to 
find rational points on an elliptic curve over Q up to logarithmic height 
600 (provided the coefficients of the original eUiptic curve are not too 
large). The main bottleneck comes in the 3-descent, where we must 
compute the class group and units of each number field generated by 
the co-ordinates of a 3-torsion point of E. (There is usually just one 
such field, and it has degree 8.) Fortunately, since our final answer 
comes in the form of a rational point, there is no need to perform these 
intermediate calculations rigorously. 

Stein and Watkins [21] have constructed a database of elliptic curves 
that is expected to contain most elliptic curves over Q of prime con- 
ductor with N < 10^°. We are able to show that every curve in their 
database (of prime conductor) has rank at least as large as predicted 
by the conjecture of Birch and Swinnerton-Dycr. Prior to our involve- 
ment, this had been reduced by Cremona and Watkins to a list of 35 
curves of analytic rank 2 for which one generator of small height (less 
than 34) was known, but a second generator of large height (greater 
than 220) remained to be found. In each case wc were able to find the 
second generator using either 6-descent or 12-dcsccnt. 

We give two numerical examples in §7. In the first we use 6-descent 
to find a pair of non-zero integers x and y for which both 

— 8Q9xy + and + 8Q9xy + y^ 

are squares. We find that the smallest solution is given by x and y 
with 534 and 537 decimal digits respectively. Our second example is 
the last in the list of 35 curves mentioned above. In this case we use 
12-descent to find a generator of height 642.63. 
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2. Computing twists 

Let A; be a field of cliaracteristic zero, witli algebraic closure k. We 
fix an elliptic curve E over k with identity O. Let n > 2 be an integer. 
A base diagram [E — > P"~^] of level n is a morphism defined over k 
determined by the complete linear system Thus any two base 

diagrams differ by an element of PGL„(A;). 

More generally we consider diagrams [C — > S] where C is a torsor 
under E and 5" is a variety (both defined over k) and the map C — > 5" 
is a morphism defined over k. Two such diagrams [(pi : Ci — > Si] and 
[02 '■ C2 — > 5*2] are isomorphic if there is an isomorphism of torsors 
a : Ci = C2 and an isomorphism of varieties P : Si = S2 satisfying 
02 o a = /3 o 01- We define a Brauer-Severi diagram [C — > S] to be a 
twist of the base diagram. Then 5" is a Brauer-Severi variety, and the 
morphism C S is that determined by a complete linear system \D\, 
where the divisor D is linearly equivalent to all its Galois conjugates, 
but need not itself be defined over k. 

We recall from [5, Paper I, §1.3] that the Brauer-Severi diagrams are 
parametrised, as twists of a fixed base diagram, by the Galois coho- 
mology group H^{k, E[n]). Moreover there is an obstruction map 

Ob„ : H\k,E[n]) Br(fc)[n] 

taking the class of [C S] to the class of [S]. In general this map 
is not a group homomorphism. We are interested in the elements of 
H^{k, E[n]) with trivial obstruction, equivalently those that are repre- 
sented by diagrams of the form [0„ : C — > P"~^]. With the convention 
that points of P"^i arc written as column vectors, we define the "char- 
acter" associated to 0„ to be the unique morphism of /c-group schemes 
Xn '■ E[n] ^ PGLji such that 

UT + P) = Xn{T)MP) 

for aU T G E[n](k) and P eC(k). 

In §3 we use representations of the Heisenberg group to prove 

Theorem 2.1. Let m and n he coprime integers satisfying 

(1) u^n = ±1 (mod m) and v^m = ±1 (mod n), 

for some integers u and v. Let Xm, Xn dnd Xmn be the characters 
associated to base diagrams of level m, n and mn. Then there is a 
morphism of k- group schemes 

:i : PGL^ x PGL„ — > PGL^„ 

such that 

E{Xm{S),Xn{T)) = XmniuS + vT) 
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for all S e E[m]{k) and T G E[n]{k). 

Let [C P"-^] be a twist of the base diagram [E P""^]. By 
definition this means that there is a commutative diagram 

C ^ P"-i 



E *- P"-i 

where a and f3 are isomorphisms defined over k. We say that the matrix 
Bn G PGL„(/c) representing /3 is a flex matrix for [C P""^]. In §6.2 
we give some algorithms for computing flex matrices, starting from 
equations for C. Conversely, it is clear that we can recover equations 
for C from a flex matrix (by starting with equations for E and making 
the relevant substitution). 

Our next result explains how Theorem 2.1 is used to construct an 
mn-covering from an m-covering and an n-covering. 

Proposition 2.2. In the setting of Theorem 2.1, suppose that ^ G 
H^{k,E[m]) and rj G H^{k, E[n\) are represented by Brauer-Severi di- 
agrams [Cm p»"-i] and [Cn — >■ P"'"'''] with flex matrices B^ and 
Bn- Then + vrj E H^{k^E[mn\) is represented by a Brauer-Severi 
diagram [Cmn P™""!] with fiex matrix B^n = ^(5^., -Bn)- 

Proof: Let a G Gal(A;/A;). Since a{Bm)B~^ = Xmi^a), '^{BnjB'^ = 
XniVa) and S is deflned over k, we have 

a{Bmn)B-l = E{a{BjB;,\a{B^)B-') 

= XmniuCa + VTja). 

Thus Bmn represents a change of co-ordinates on P"*"-i taking E to 
a curve Cm„ deflned over k. Then [Cmn 'p^nn-ij jg -^.j^g twist of 
[E P'"'^-!] by u^ + vr}e H\k, E[mn]). □ 

Remcirk 2.3. The proposition shows that if ^ and r] have trivial ob- 
struction, then so does + vr]. In fact, standard properties of the 
obstruction map (see [5, Paper 1], [17], [25]) already show that 

(2) OhmnH + ^V) = OhmiO + Ohniv) 

for m and n coprime. Interestingly, the hypothesis (1) of Theorem 2.1 
is that the coefficients on the right hand side of (2) are ±1. 

We are mainly interested in the case m and n are consecutive inte- 
gers. We can therefore either take u = v — 1 in Theorem 2.1, or use 
the refined version of the theorem we give next. 
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We write P(Mata,b) for the projective space of dimension ab — 1 
formed from the vector space of a x 6 matrices. Taking n x n minors 
defines a rational map 

: P(Mat„,„+i) - ^ ; A ^ {. . . : {-ly det(A«) : . . .) 

where A^*^ is A with the ith column deleted. The following refinement 
of Theorem 2.1 is proved alongside the original theorem in §3. 

Theorem 2.4. Let : E ^ P"-^] and [</)„+i : ^ ^ P'^] be base 
diagrams of levels n and n + 1, with associated characters Xn CLndxn+i- 
Then there is a base diagram 

[(t>n,n+i ■■ E ^ P(Mat„,„+i)] 

of level n{n+ 1), with associated character Xn,n+\ given by 

Xn,n+l{S + T):A^ Xn{S)AXn+l{T) 

for all S e E[n](k) and T e E[n + l](k). Moreover if [n] : E ^ E is 
the multiplication-by-n map then the diagram 



E 



E 



P(Mat„,„+i) 



I 
1 

V 

.pn_ 



commutes. 



We obtain equations for an n{n + l)-covering from an n-covering 
and an {n + l)-covering, by first finding the base diagram 0„,„+i of 
Theorem 2.4, and then twisting by the fiex matrices -B„ and 
These twists may be performed one after the other. In fact twisting by 
Bn first gives the following generalisation of Theorem 2.4. 

Theorem 2.5. Let [0„ : C P"""-*^] be a Brauer-Severi diagram and 
[(pn+i '■ E — > P"] a base diagram, of levels n and n+1, with associated 
characters Xn (^nd Xn+i- Then there is a Brauer-Severi diagram 

[<Pn,n+l ■■ C P(Mat,,„+i)] 

of level n{n + 1), with associated character Xn,n+i given by 



Xn,n+1 {S + T):A^Xn{S)Axn+iiT) 
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for all S e E[n\{k) and T e E[n + l]{k). Moreover if n : C ^ E is the 
n-covering map then the diagram 

C 



E 

commutes. 

Proof: Theorem 2.4 is the special case where (C, [D\) = {E, [n.O\). 
We twist by to obtain the general result. □ 

The advantage of using Theorem 2.5 (instead of Theorem 2.4) is that 
we then only need to twist by Bn+i (rather than both En and Bn+i) 
to obtain the desired n{n + l)-covering. In §5 we use invariant theory 
to give an alternative proof of Theorem 2.5 in the cases n = 2, 3. In 
particular we obtain explicit formulae for 02,3 and ^3^4 which we then 
use in our implementations of 6-descent and 12-descent. 

3. The Heisenberg group 

We continue to work over a field k of characteristic 0. Let E be 
an elliptic curve with identity C, and n > 2 an integer. We recall 
that if D is a divisor on E of degree n then the Riemann-Roch space 
C{D) has dimension n. Let Vn = C{n.O)*. Then there is a "co- 
ordinate free" base diagram [E —>■ P(V^)] with associated character 
Xn ■■ E[n] ^ PGL(V;). 

Definition 3.1. (i) The theta group 0„ is the inverse image of x„(£^[n]) 
in GL(V^). It sits in a commutative diagram of A;-group schemes with 
exact rows: 

> Gm ^ On ^ E[n\ ^ 

Xn 

G„ GL(K) PGL(K) 0. 

(ii) The Heisenberg group iJ„ is the inverse image of Xn{E[n]) in 
SL{Vn). It sits in a commutative diagram of fc-group schemes with 
exact rows: 

^ /in ^ ^ E[n] ^ 

Xn 



Pn,n+1 



P(Mat„,„+i) 

I 

I M 

>pn 



^ i^n ^ SL(\4) ^ PGL(\4) ^ 0. 
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Remark 3.2. It is well known (see e.g. [13]) that over k = k we may 
choose a basis for such that is generated by 

/I ••• \ /O ••• 1\ 

Cn ■ ■ ■ 1 1 • ■ ■ 

C ■■■ 01---00 

\o ■■■ crv Vo ■■■ 1 0/ 

and the scalar matrices. (Here (n ^ k is a primitive nth root of unity.) 
In particular, taking commutators in 0„ defines a non-degenerate pair- 
ing Cn : E[n\ X E[n\ — > which turns out to be the Weil pairing. 

The group Hn{k) is a non-abelian group of order with centre 

A*n(^)- 

Definition 3.3. A representation p : Hn{k) — > GLd{k) has central 
character [r] if p{() — C^d for all C £ l^n{k)- 

Lemma 3.4. Lei r be an integer coprime to n. Then 

(i) Every representation of Hn{k) with central character [r] is a direct 

sum of irreducible n- dimensional representations. 

(a) Up to equivalence, there is a unique n-dimensional representation 

of Hn{k) with central character [r]. 

Proof: Let p be a representation of Hn{k) with central character [r]. If 
(T,T e H^{k) lift 5,T e E[n](k) then p{a) p{t) p{a)-^ = en{S,Typ{T) 
and so Tr(p(T)) = 6^(5', T)'' Tr(p(r)). Since r is coprime to n, the 
character of p vanishes outside the centre of if„(A;). Then orthogonahty 
relations in the character table show that p is irreducible if and only if it 
has dimension n. This proves (i) and the uniqueness in (ii). Existence 
is clear in the case r = 1. In general we take the rth tensor power and 
apply (i). □ 

To prove Theorem 2.1 we need to construct a morphism S that is 
defined over k. We therefore study representations p : Hn{k) — > GLrf(/c) 
that are Galois equivariant, equivalently those that induce a morphism 
of /c-group schemes GL^. We call these representations of 

By construction, Vn is an n-dimensional representation of iJ„ with 
central character [1]. So by Lemma 3.4(i) it is irreducible. We might 
hope to construct other irreducible n-dimcnsional representations of 
Hn by any one of the following standard methods. 

(i) Take a subspace or quotient of a tensor power of Vn- 

(ii) Replace Vn by one of its Galois conjugates. 

(iii) Precompose p : — > GL(V^) with an automorphism of 
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We see no way of using (i) in tlic proof of Theorem 2.1, other than 
in the case of V* — A"~^T4. (The problem is that there is no analogue 
of Lemma 3.4(i) with replaced by GL„.) Our restriction to Galois 
equivariant representations rules out the use of (ii). 

To use (iii) we must first describe the (Galois equivariant) automor- 
phisms of Hn. Each automorphism of Hn induces an automorphism 
of E[n]. Wc may identify Aut{E[n]) as the centraliser of the image of 
Galois in Aut^(i?[n]) = GL2(Z/nZ). So in general the only automor- 
phisms of E[n\ are the maps T i— >• aT for a e (Z/nZ)^. We show 
that each of these maps hfts to an automorphism of (Without our 
insistence on Galois equivariance, this would be trivial.) 

Lemma 3.5. For each a e (Z/nZ)^ there is a morphism of k- group 
schemes ipa '■ — > making the diagram 

^ i^n ^ Hn ^ E[n] ^ 



^ Hn ^ Hn ^ E n\ 

commute. 

Proof: The [— l]-map on E lifts to a matrix l e GL„(/c). Conjugation 
by i gives the map ■^-i. In general we first define 

A : Hn ^ fJ^n', h ^ ihr^h 

and then put 

iPa-.Hn^Hn-, h ^ X{hY^''-'^^ h\ 

Since \{xy) = xy{LXL~^){iyi~^) = \{x)\{y)xyx~^y~^ for all x,y & Hn, 
it is easy to check that ipa is a group homomorphism. Galois equivari- 
ance is clear from the construction. □ 

Let Ki"^ be the representation of if„ given by 

HnXVn^Vn; {k, v) ^ ll^a{h)v. 

It is an irreducible n-dimensional representation of Hn with central 
character [a^]. Taking these representations and their duals we obtain 
all the representations of Lemma 3.4(11) with r = ±a^ (mod n). 

We write tp : E ^ E for translation by P G E{k). We recall 
from [16, §23], (see also [5, Paper I]), that the theta group ©„ may be 
described as pairs 

e„(^) = { (/,r) e k{Er X E[n](k) I div(/) = r^in.O) - n.O} 
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with group law 

(3) {f,S)*{g,T) = {{T*f)g,S + T). 

There is a natural action of 6„ on V*j^ — C{nN.O) given by 

(4) {f,T): h^rl^h/n. 

We use this notation to relate the Heisenberg groups for different 
levels n. 

Proposition 3.6. Let m and n he coprime integers. Then there is an 
isomorphism of k- group schemes 

{{f,S),{g,T)) ^ {r,S)*{g-^,T). 

For the proof we need two lemmas. 

Lemma 3.7. Let Mt G ©„(^) be a lift ofTe E[n\(k). IfT has exact 
order r then 

det(MT) = (-l)''('^-^)/''M^. 

Proof: By Remark 3.2 we know that Mt is similar to 

ADiag(l,C.,...,Cr') 

for some \ E and C,r a primitive rth root of unity. Then det(Mr) = 
^n(n-i)/2^„ = (-1)»('^-i)Am^ as required. □ 

Lemma 3.8. Let N be a positive integer. Then there is a commutative 
diagram of k- group schemes 



det 



nN 



det 



where a : {f,T) {f^,T). 

Proof: It is clear from (3) that a is a group homomorphism. Now let 
X e 0„ and assume n is odd. Using Lemma 3.7 we compute 

det(Q;(x)) = o;(x)"^ = Q;(detx)^ = (detx)^'. 

The calculation for n even is similar. □ 

Proof of Proposition 3.6: Let {f,S) and {g,T) be elements of 
e^(^) and e„(^). The commutator of and (g'^^T) in e^„(^) 
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is both an mth root of unity and an nth root of unity, and therefore 
trivial. So there is a morphism of /c-group schemes 

{if,S),{g,T)) ^ {r,S)*{g-^,T). 

By Lemma 3.8 we can restrict to a map Hm x if„ — > Hmn- Since m 
and n are coprime, this restriction is clearly an isomorphism. □ 

We recall that if„ acts on C{nN.O) as specified in (4). 

Lemma 3.9. The Hn-invariant subspace of C{nN.O) is trivial unless 
n divides N , in which case it has dimension N/n. 

Proof: By Lemma 3.8 there is a group homomorphism Hn{k) 
HnN{k) given by (f,T) ^ {f^,T). By the proof of Lemma 3.4 the 
character of C{nN.O) is trivial outside the centre of HnN{k). The 
same is therefore true when C{nN.O) is viewed as a representation of 
Hn{k). We are done by the orthogonality relations in the character 
table. □ 



Proposition 3.10. Let m and n be coprime integers. Suppose that 
n = (mod m) and m = b^ (mod n) for some integers a and b. 
Then there is a k-isomorphism of Hmn-representations 

Proof: We recall that Vm ^ is an irreducible iJm-representation with 
central character [a^]. Likewise Vn^'' is an irreducible if„-representation 
with central character [6^]. Then Proposition 3.6 makes Vm^ (8) Vn'^^ 
an irreducible representation with central character [1]. Indeed 

(Cm, Cn) ^HmXHr, acts On v}^^ ® V^"^ as CtCn ^nd on Vmn as CC- 
The required isomorphism vr exists by Lemma 3.4(ii). Finally, since 
we work with Galois equivariant representations, we can choose an 
isomorphism vr that is defined over k. □ 

Proof of Theorem 2.1: We first treat the case u^n = 1 (mod m) 
and v'^m = 1 (mod n). Let a and b be inverses for u and v modulo m 
and n respectively. Then the map tt : T4i (g) — > constructed in 
Proposition 3.10 satisfies 

AMf, S)vm ® Mg, TK) = ((r , S) * {g^, T))t:{v^ ® 

for aU (/, S) e Hm, {g, T) e Hn, Vm e Kn, Vn G K- Passing to P(Knn) 
we obtain 

T^{Xm{0'S)v,ri ® Xn{bT)Vn) = Xmn{S + T)'K{Vm Vn). 
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Hence 

O iXmiaS) M XnibT)) = Xmn{S + T) O % 

where 

m : PGL(K„) X PGL(K) ^ PGL(K„ ® K) 
is the natural map. The theorem now holds on defining 
S : PGL(Kn) X PGL(K) ^ PGL(K^„) 

In general, if u^n = — 1 (mod m) or v'^m = — 1 (mod n) then we 
replace Vm^ or Vn^'' by its dual in Proposition 3.10, and the proof 
carries through as before. □ 

Next we prove our refined version of the theorem in the case m and 
n are consecutive integers. 

Proof of Theorem 2.4: The analogue of Proposition 3.10 gives a 
/c-isomorphism of if„(„+i)-modules 

vr : KT+i = K(n+i)- 
Hence there is a base diagram 

(5) :£;^P(K«)K*+i) 

with associated character 

Xn,n+l{S + T) = Xn{S) ^ Xn+l(T)*. 

Picking bases for K and K+i, we identify P(K) = P(K+i) = P" 
and P(K = P(Mat„,„+i). Then Xn,n+i is given by 

(5 + T) : A^Xn(^)^Xn+l(±T) 

where the sign ± is immaterial by the case a = —1 of Lemma 3.5. This 
proves the first statement of Theorem 2.4. 

The base diagram (5) is given by a matrix 21 G Mat„,„+i (/?(£')) whose 
entries are a basis for C{n{n + 1) .O) . Let r be the rank of this matrix. 
Then the r x r minors define a morphism 

^:E^ P(A'-K%) 

with the property that $ o T5 = $ for all S e E[n]{k). Hence $ 
factors through [n] : E ^ E. Therefore \ deg{^*H) where H is 
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the hyperplane section on F{A''V*_^i). Since deg($*i/) = rn(n + 1) it 
follows that r — n. Thus there is a commutative diagram 

E '^-"^^ ^ P(K eg) v;:^,) 
I 
I 

E -P(K+i) 

where the pull back of the hyperplane section by 7 has degree n + 1. 
We must show that 7 = (pn+i- 

It is easy to see that 7 shares with 4)n+i the property 

7(T + P) = Xn+i(T)7(P) 

for all T e E[n + l\{k) and P G E{k). Since Vn+i is an irreducible rep- 
resentation of Hn+i the image of 7 spans P(V^+i). So 7 is an embedding 
by a complete linear system. 

By Lemma 3.9 the subspace of £(n^(n + 1).0) fixed by Hn has 
dimension n + 1. Since the n x n minors of 21 are linearly independent 
they are a basis for this space. We show in Proposition 3.11 that if 
g e k{EY with 

div(^) = (n + l)[n]*0 - n^{n + l).0 

then g is fixed by Hn- Hence we may assume that the first n x n minor 
of 21, viewed as a homogeneous form of degree n in the co-ordinate ring 
of P(K ® meets E with divisor (n + l)[n]*C). Then {n + 

is the pull back of a hyperplane section by 7, and hence 7 is a base 
diagram of level n + 1 . 

Since 7 and are base diagrams of level n+1 they can only differ 
by an element of PGL(V^„+i). But they also have the same character 
Xn+i- Since the image of Xn+i is its own centraliser in PGL(V^+i), it 
follows that 7 = (t>n+i as required. □ 

Let (7 : Div(£') — > be the summation map. An unexpected diffi- 
culty in the proof of Theorem 2.5 is showing that, if D is a hyperplane 
section for the image of 7, then (y[D) = O. (Comparing pull backs via 
/X o (l)n,n+i and 7 o [n] only gives that (j{D) is an n-torsion point.) We 
appeal to the case N — n + 1 oi the following proposition. 

Proposition 3.11. Let g G k{Ey with diY{g) = [n]*0 - v?.0. Then 
g^ is fixed by the natural action of on jC{n^N.O). 

For the proof we need two lemmas. 
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Lemma 3.12. LetT E E{k) he a point of exact order n. Let f E k{E)^ 
with div(/) = n.T - n.O. If S e E(k) with 2S and nS O then 



n-1 



llf{s+iT)^f{sr. 



i=0 

Proof: The rational function P f{P)f{T — P) has trivial divisor 
and is therefore constant. Hence for any integer i, 

f{S + iT)f{S-iT)^f{Sf. 

We are immediately done in the case n is odd. In the case n is even it 
remains to show that f{S) = f{S + T2) where T2 = f T e E[2](k). Let 
X e k{E)^ with div(a;) = 2.T2 — 2.O. Then comparing divisors gives 

(n-2)/2 

n rU^f = cx-^' 

for some constant c E . Evahiating each side at ±5* we deduce 
fjS + T,) (<-S)Y\_ 

f{s) V <s) J 

□ 

Lemma 3.13. Let T e E{k) be a point of exact order n. Let f,g E 
k{EY with div(/) = n.T - n.O and div(y) = [n]*C> - n^.O. Then 

(i) The pair (/, — T) belongs to if and only «/nr=o^ '^irf — {~^)^~^ ■ 
(a) If f satisfies (i) then = /"■. 

Proof: (1) By Lemma 3.7 the pair (/, —T) belongs to if and only 
if (/, — T)" = (—1)""^. By the group law (3) this is equivalent to the 
stated condition. 

(ii) Each side has divisor n'^.T — n'^.O. So it suffices to check equality at 
-S" E E{k) with 2S — T and nS ^ O. Since g has a pole of order — 1 
at O, we deduce [— l]**? = {—l)"'~^g. So the left hand side evaluated at 
S is (—1)""^. By (i) and Lemma 3.12 we also get (—1)""^ on the right 
hand side. □ 

Proof of Proposition 3.11: If (/, -T) e Hn then 

where for the first equality we use (4), and for the second equality we 
use Lemma 3.13. □ 
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4. Invariant Theory 

We recall some classical invariant theory of binary quartics and 
ternary cubics, as surveyed in [1]. We then add to this theory by 
introducing what we call "covariant columns". These are used in §5 

to give formulae for 02,3 and 03 4. In this section we give a complete 
classification of the covariant columns. This is more that we need in §5, 
but serves to explain where our formulae come from. 
In this section k will be a field with char (k) ^ 2, 3. 

4.1. Binary quartics. We study the invariants and covariants of the 
binary quartic 

U X2) = ax\ + hx\x2 + cx\x\ + dxix\ + ex\. 

For a polynomial F G A;[xi,X2] and matrix g G G\j2{k) we write 

{Fog){xi,X2) = F{gnXi + gi2X2, 921X1 + 022X2) 

Thus {F o g){x) = F{g:x.) where x is the column vector [xi, X2)'^- 

Definition 4.1. A covariant F = F{U;x.) of order m, degree d and 
weight p, is a homogeneous polynomial of degree m in Xi,X2, whose 
coefficients are homogeneous polynomials of degree d in the coefficients 
of the binary quartic U, such that 

F{Uog;^) = {detgrF{U;g^) 

for aU g G GL2(A;). 

By considering g a scalar matrix, it is clear that the order m, degree 
d and weight p of a covariant are related by Ad — 2p + m. It is well 
known that the ring of invariants (an invariant is a covariant of order 0) 
is generated by C4 and cq where 

C4 = 2^(12ae- 36rf + c2) 

ce = 2\12ace-27a£ -2n'^e + %cd-2c^). 

Moreover, the ring of covariants is generated by C4, Ce, C/, H and J, 
where 

H{x,,X2) = idet(^)^ 

and 

(6) J{X1,X2) = nlgf) , 
subject only to the relation 

(7) 27J^ = -H^ + 3c4HU^ - 2cqU^. 
Since C4, Cg, U, H and J have weights 4, 6, 0, 2 and 3 we deduce 
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Lemma 4.2. Every covariant of odd weight is divisible by J. 

We now define what we call a "covariant column" . 

Definition 4.3. A covariant column v = v(f/; x) of order m, degree d 
and weight p, is a column vector v = [vi, ^2)"^ of degree m homogeneous 
polynomials in xi,X2, whose coefficients are homogeneous polynomials 
of degree d in the coefficients of the binary quartic U, such that 



for all g e GL2(A;). 

By considering g a scalar matrix, it is clear that the order ni, degree d 
and weight p of a covariant column are related hy Ad — 2p + m — l. The 
column vector x itself is a covariant column of order 1, degree and 
weight 0. The proof of the following lemma is entirely straightforward, 
and so wiU be omitted. 

Lemma 4.4. (i) If F is a covariant of order m, degree d and weight p 
then dF = {—■§^, §^)'^ is a covariant column of order m — 1, degree 
d and weight p + 1, 

(ii) If vi and V2 are covariant columns of orders mi, m2, degrees di, 

62 and weights pi, p2, then the determinant [vi, V2] is a covariant of 
order mi + m2, degree di + 0^2 and weight pi + p2 — I ■ 

For F a covariant of order m we have [x, dF] — mF. 

Theorem 4.5. (i) The covariant columns of even weight form a free 

k[c4, Ce, U, H]-module of rank 2 with basis x, dJ. 

(ii) The covariant columns of odd weight form a free k[c4,CQ,U, H]- 
module of rank 2 with basis dU, dH. 

Proof: (i) Since [x, dJ] = 6 J 7^ 0, we can write any covariant column 
as V = FiX + F2dJ for some rational functions Fi and F2. Then 
[v, dJ] = 6JF1 is a covariant of odd weight. It follows by Lemma 4.2 
that Fi is a covariant. The same argument shows that F2 is a covariant. 
(ii) Since we can rewrite (6) as [dU, dH] = 12 J, the proof carries over 
exactly as in case (i). □ 

Corollary 4.6. The covariant columns form a module over the ring of 
covariants, generated by x, dU , dH, dJ , subject only to the relations 



v{Uog;x)^{detgrg-\{U;gx) 



3Jx 
ISJdJ 
9JdU 
9JdH 



HdU - UdH 

2{c4UH - C6U^)dU + {c^U^ - H^ 
{aU'^ - H^):)c + 6UdJ 
2{ceU^ - C4UH):>c + 6HdJ 



)dH 
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Proof: It only remains to describe the action of multiplication by J. 
The first relation is obtained by applying the proof of Theorem 4.5(ii) 
to V = Jx, and the second is obtained by differentiating the syzygy (7). 
We take linear combinations, and use the syzygy once more to obtain 
the final two relations. □ 



i,i=l,2,3 



4.2. Ternary cubics. We study the invariants and covariants of the 
ternary cubic 

C/(xi, X2, xz) — ax\ + hx\ + cx\ + . . . + 111x1X2X3. 

For a polynomial F e k[xi,X2,X3] and matrix g G GL3(A;) we write 
{F o g){'x.) = F{gx.) where x is the column vector ( y. The 

definition of a covariant is exactly analogous to that in the case of a 
binary quartic. By considering g a scalar matrix, it is clear that the 
order m, degree d and weight p of a covariant are related by 3d — 3p+m. 
The Hessian is a covariant of order 3, degree 3 and weight 2 given by 

H{xr,X2,xs) = -idet(^)^ 
There are invariants C4 and Cg such that 

H{\U + fiH) = 3(c4AV + 2cQ\fi^ + clfi^)U + (A^ - Sc^Xfi^ - 2cq^^)H, 

and it is well known that these generate the ring of invariants. 

If Qi{'x) and Q2(x) are ternary quadrics, with corresponding 3x3 
symmetric matrices Ai and A2, i.e. 

gi(x) = ix'^Aix and Qalx) = ^x^Aax, 

then we write {Qi, Q2} for the 3x3 symmetric matrix satisfying 

adj(Ai + tA2) = adj(Ai) + t{Qi, Q2} + adj(A2). 

We can then define a symmetric matrix of quadrics 

M ^ fsc/ dH\ 

Z^i,j=i \ dxi ' dxj / -^^-^o 

and covariants 

^ ' ^ ^\ - 1 d(U,H,e) 

J[Xi,X2,X3) - 3 d(^a:uX2,X3)- 

Again it is well known that the ring of covariants is generated by C4, 
ce, U, H, © and J subject only to a relation which reduces mod U to 

(9) J2 = - 27c4e//^ - 5AceH^ (mod U). 

Since C4, Cq, U, H, 6 and J have weights 4, 6, 0, 2, 6 and 9 we 
deduce 
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Lemma 4.7. Every covariant of odd weight is divisible by J. 

Our definition of a covariant column is exactly analogous to that in 
the case of a binary quartic. However we now also need to work with 
"contravariant columns" . 

Definition 4.8. A covariant column, respectively contravariant col- 
umn, V — \{U ; x) of order m, degree d and weight p, is a column vec- 
tor V = {vi, V2, Vs)^ of degree m homogeneous polynomials in Xi,X2, x^, 
whose coefficients are homogeneous polynomials of degree d in the co- 
efficients of the ternary cubic U, such that 

v{Uog;x)^{detgyg-\{U;g^), 

respectively 

yr{Uog;^) = {detgyg^viU;g7,), 

for all g e GL3(^). 

By considering g a scalar matrix, it is clear that the order m, degree d 
and weight p of a covariant column, respectively contravariant column, 
are related by So? = 3p + m — 1, respectively 3d = 3p + m -|- 1. The 
column vector x itself is a covariant column of order 1, degree and 
weight 0. The proof of the following lemma is entirely straightforward, 
and so will be omitted. 

Lemma 4.9. (i) If F is a covariant of order m, degree d and weight p 
then VF = (^, is a contravariant column of order m — 1, 

degree d and weight p. 

(a) Let Vi and V2 be covariant or contravariant columns of orders mi, 
m2, degrees di, d2 and weights pi, p2. Then 

(1) //vi is a covariant column, andv2 a contravariant column then 
the dot product Vi • V2 is a covariant of order rui + m2, degree 
di + d2 and weight pi+ P2- 

(2) //vi and\2 ore covariant columns then the cross product \1XW2 
is a contravariant column of order mi + m2, degree di + d2 and 
weight pi + P2 — 1- 

(3) // Vi and V2 are contravariant columns then the cross product 
vi XM2 is a covariant column of order mi -\- m2, degree di -\- d2 
and weight pi + P2 + ^■ 

(Hi) If w is a contravariant column of order m, degree d and weight p, 
then Mv is covariant column of order m + 2, degree d + i and weight 
p + 4:. 
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For F a covariant of order m we have x. VF = mF. The determinant 
of the three vectors Vi, V2, V3 will be denoted 

[Vi, V2, V3] = (Vi X V2) • V3 = Vi • (V2 X Vs). 

We define contravariant columns u = Vt/, h = Vi/, t = V0 and 
covariant columns e = Mu and f = Mh. 

Theorem 4.10. (i) The covariant columns, respectively contravariant 
columns, of even weight form a free /c[c4, Cg, C/, Q]-module of rank 3 
with basis e, f, respectively u, h, t. 

(a) The covariant columns, respectively contravariant columns, of odd 
weight form a free k[c4, Cq, U, H, Q]-module of rank 3 with basis u x h, 
u X t, h X t, respectively x x e, x x f , e x f . 

Proof: (i) Since [x, e, f] = —2 J ^ 0, we can write any covariant 
column as V = FiX + F2e + F^f for some rational functions Fi, F2, 
F3. Then [v, e, f] = —2JFi is a covariant of odd weight. It follows 
by Lemma 4.7 that Fi is a covariant, and likewise for F2 and F3. The 
case of a contravariant column is similar, since we can rewrite (8) as 
[u, h, t] = 3 J. 

(ii) Since [u x h, u x t, h x t] = [u, h, t]^ = 9 7^ 0, we can write any 
covariant column as v = Fi(u x h) + F2(u x t) + F3(h x t) for some 
rational functions Fi, F2, F3. Then v ■ t = 3JFi is a covariant of odd 
weight. It follows by Lemma 4.7 that F^ is a covariant, and likewise 
for F2 and F3. The case of a contravariant column is similar. □ 

Corollary 4.11. (i) The covariant columns are generated as a module 
over the ring of covariants 6y x, e, f , u x h, u x t and h x t. 
(ii) The contravariant columns are generated as a module over the ring 
of covariants &?/ u, h, t, x x e, x x f and e x f . 

As in the case of binary quartics, there is no difficulty in finding 
the relations (describing the effect of multiplication by J) . Since these 
relations are somewhat messy, we instead record the identities 

xu = 3C/, xh = 3//, xt = 6e, eh = fu = e 

and 

e-u = 3(//2 _ 3c4[/2) 

f-h = 3(3c4i/2 - Scgf/// + 3c2[/2) 

e-t = 12{3c4H^ -C4UQ -UcqUH^ + 9clU^H) 

f • t = 12(c4//e - ScqH^ - SceUe + QclUH^ - Sc^CqU^H - dcp^) 

from which the relations may be recovered by following the proof of 
Theorem 4.10. 
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5. COVARIANT MATRICES 

We use the invariant theory of binary quartics and ternary cubics to 
given an alternative proof of Theorem 2.5 in the cases n = 2, 3. 

5.1. The case n = 2. A binary quartic U e k[xi,X2] is non-singular 
if its discriminant A = (c^ — Cg)/1728 is non-zero. We write P(l, 1, 2) 
for the weighted projective space where the co-ordinates xi, X2, y are 
assigned degrees 1, 1, 2. 

Proposition 5.1. Let U G A;[xi,a:2] be a non-singular binary quartic 
with invariants C4,Cq G k and covariants H,J& k[xi,X2\. Then 

(i) The equation y^ = U{xi,X2) defines a smooth curve of genus one 
C2CP(1,1,2). 

(ii) The Jacobian E 0/C2 has Weierstrass equation 

Y'^Z ^X^ - TJc^XZ^ - bAceZ^. 

(Hi) The 2-covering map tt : C2 ^ E is given by 

(Z:X:Y)^ (yU(xi,X2) : -3yH(xi,X2) : 27J(xi,X2)). 

(iv) Let 03 : — > be the natural inclusion. Then the Brauer-Severi 
diagrams 02 : (^2 ^ P^ ; {xi '■ X2 : y) ^ {xi : X2) and 02,3 : C2 — > 
P(Mat2,3) ; (xi :x2:y)^ ^2,3, where 



A 



0x2 0x2 

2-3—1 qOh o au 

ax\ 0x1 




satisfy the conclusions of Theorem 2.5. 

Proof: Statements (i)-(iii) are well known: see [1], [23]. 
(iv) Let D be the hyperplane section for (f)2 '■ C ^ F^. Then C{3D) has 
basis xl, x\x2i Xix^, x^, Xiy, X2y. We write the entries of ^42,3 as linear 
combinations of these basis elements, and arrange the coefficients in 
a 6 X 6 matrix. The determinant of this matrix is 2^3^A. Hence 
02,3 : C2 — > P(Mat2,3) is an embedding by the complete linear system 

\3b\. 

In the notation of §4.1 we have ^2,3 = {9dH,3dU,yx). The 2x2 
minors of this matrix are 

-3y[K,dU]\ f-yU\ 

9y[^,dH] =12 3yH 
-27[dU,dH]J \-'^7Jj 

So the final statement of Theorem 2.5 is immediate from (iii). 

It remains to show that S G E[2]{k), respectively T G E[3]{k), acts 
on the image of 02,3 as left multiplication by X2{S), respectively right 
multiplication by X3(T'). 
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The statement for S E E[2]{k) follows formally from the covariance 
of the columns of ^2,3- Indeed, writing ^42,3 = (ai,a2,ya3), where the 
are covariant columns, Definition 4.3 gives 

ai{Uog;x.)^ g~^ai{U,gx.) 

for all g e SL2(^). So if ^ e SL2(^) is a lift of X2(S) then Uog^U 
and 

ghA^ ■ y) = h,3{9^ ■ y) 

as required. 

We deduce the statement for T e £'[3](/c) from the parts of Theo- 
rem 2.5 already estabhshed. To this end, let Ms and Mt be endomor- 
phisms of Mat2,3(A:) lifting X2,3('S') and X2,'i{T) respectively. We have 
shown that Ms is left multiplication by a 2 x 2 matrix. Accordingly we 
view Mat2,3(/c) as an if2-iiiodule via left multiplication. (In this proof 
we write as a shorthand for Hn{k).) Since 2 and 3 are coprime, the 
commutator of Ms and Mt is trivial. Hence Mt is an endomorphism 
of Mat2,3(fc) as an if2-Kiodulc. Since the standard representation V2 of 
H2 is irreducible, it follows by Schur's lemma that Mt belongs to 

EndH2(Mat2,3(^)) = End^f2(V"2 © 1^2 © V2) = Mat3(I). 
Thus Mt is right multiplication by a 3 x 3 matrix. Let ^(T) be the 
image of this matrix in PGL3(A;). It remains to show that the characters 
X3 : ^[3] PGL3 and ip : E[3] PGL3 are equal. Recalling that 
(psOTT — jio 02,3, we take P e C2{k) and compute 

=^ 03(7r(P) + 2T) = fiihAP^T)) 
=^ XsiTr'U^P)) = V'(r)-V(02,3(P)). 
Hence X3 = as required. □ 

5.2. The case n — 3. A ternary cubic U e k[xi, X2, X3] is non-singular 
if its discriminant A = (C4 — Cg)/1728 is non-zero. The covariant 
columns e, f and contravariant columns u, h were defined in §4.2. 

Proposition 5.2. Let U e k[xi,X2,X3] be a non- singular ternary cubic 
with invariants C4, cg G k and covariants H,Q, J E k[xi,X2,xs\. Then 
(i) The equation (a; 1, 0:2, 0:3) = defines a smooth curve of genus one 
C3 C P2. 

(a) The Jacobian E of Cz has Weierstrass equation 
Y'^Z ^X^ - Tlc^XZ^ - bAceZ^. 
(Hi) The 3-covering map tt : C3 ^ E is given by 
{Z : X :Y)^ {H^ -.OH : J). 
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(iv) Let 4)4 : E ; {Z : X : Y) ^ {Z^ : XZ :YZ : X^). Then 

the Brauer-Severi diagrams 03 : C3 — > and 03_4 : C3 — > P(Mat3^4) ; 
{xi : X2 : Xs) I— > A^^^, where 

^3,4 = (-3f + 9C4//X e §(u X h) —Hx) , 

satisfy the conclusions of Theorem 2.5. 

Proof: Statements (i)-(iii) are well known: see [1]. 

(iv) By Theorem 4.10 the covariant columns of order 4 form a free 

^[c4, C6]-module with basis 

(10) C/x, Hx, e, f, u X h. 

The entries of these columns give us 15 ternary quartics. We arrange 
the coefficients of these quartics in a 15 x 15 matrix, and find that the 
determinant is 2"^^3^^A^. (The calculation is made easier if we first put 
U in Hesse normal form: 

U{xi,X2,x^) = a{xl + xl + xl) + 6x1X2X3.) 

Let D the hyperplane section for 03 : C3 — P^. Since the only 
ternary quartics vanishing on C3 are the entries of C/x, the above cal- 
culation shows that 03 4 : C3 — > P(Mat3,4) is an embedding by the 
complete linear system |4D|. 

A direct calculation (carried out for U in Hesse normal form) shows 
that the 3x3 minors of ^3^4 are 

II2 = 2eH^ -IScp^H -ISc^UH^ + A8ceU^H^ 
H3 = 2JH 

H4 = + 162c|t/^ - 54c|t/2i72 _ 432c4C6f/3i? 

- I8C4UHQ + UAceUH\ 

The final statement of Theorem 2.5 follows since by (iii) the composi- 
tion 04 o TT is given by 

{xi : X2 : X3) ^ {H^ : QH^ : JH : 6^). 

The remainder of the proof now carries through exactly as in the 
case n — 2. □ 

6. Computations 

Let E be an elliptic curve over Q. We use 6-descent and 12-descent 
to assist in the search for generators of -E(Q) of large height. The 
method is of greatest interest when E{Q) has rank at least 2, or E 
has large conductor, i.e. in those cases where we cannot use Heegner 
points. In this section we give some details of our implementation in 
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the computer algebra system Magma [15]. Further remarks accompany 
the numerical examples in §7. 

6.1. The method in outline. Wc begin by using the existing func- 
tions in Magma to compute n-covcrings for n = 2,3, 4. 

• The Magma function TwoDe scent, takes as input a Weierstrass 
equation for E, and returns a list of 2* — 1 binary quartics 
representing the non-zero elements of the 2-Selmer group 
S^'^\E/Q) = {Z/2ZY. 

• The Magma function ThreeDescent, written by StoU, Donnelly 
and the author, takes as input a Weierstrass equation for E, 
and returns a hst of (3* — l)/2 ternary cubics representing the 
non-zero elements of the 3-Sclmcr group S^^\E/Q) = (Z/3Z)*. 

• The Magma function FourDescent, written by Womack and 
Watkins, takes as input a binary quartic representing a non-zero 
element a e S'^'^\E/Q), and returns a list of pairs of quadrics in 
four variables, representing the elements of the 4-Selmer group 
in the fibre of S^*\E/Q) S^^\E/Q) above a. 

Each element of the n-Selmer group is now represented by (equations 
for) a Brauer-Severi diagram [C„ — > P"~^]. The Selmer group elements 
may equally be viewed as n-coverings, where the covering maps tt : 
Cn ^ E are computed using the classical formulae surveyed in [1]. 
(For n = 2, 3 we recalled these formulae in Propositions 5.1 and 5.2.) 
Replacing the covering map vr by [— 1] o tt corresponds to taking the 
inverse in the Selmer group. So in the cases n = 3, 4 each ternary cubic, 
respectively pair of quadrics, represents both a Selmer group element 
and its inverse. 

Definition 6.1. Let [C„ — > P"~^] be a Brauer-Severi diagram with 
hyperplane section D. A point P e C„(/c) is a flex if n.P ~ D. 

The flex points of a 2-covering are the roots of the binary quartic. In 
the cases n = 3, 4 the flex points (also known as points of inflection, or 
hypcrosculating points) are the intersections with H = 0, respectively 
J = 0, where if is the Hessian of a ternary cubic, and J is the covariant 
defined in [1, §3.3]. 

We recall that if [C„ P""^] is a Brauer-Severi diagram, then the 
morphism C„ — * p"-i jg that determined by a complete linear system of 
degree n. So if n > 3 then C„ — > p"-i jg embedding. We identify C„ 
with its image, which is called a genus one normal curve of degree n. 
It is well known that if n > 4 then the homogeneous ideal I{Cn) is 
generated by a vector space of quadrics of dimension n{n — 3)/2. 
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The details of 6-descent are as follows. We start with a 2-covering 
C2 = {y^ = U2{xi,X2)} and a 3-covering C3 = {C/3(xi, ^2, X3) = 0}, 
each defined over Q. Since these are coverings of the same elliptic 
curve E, we may assume that U2 and f/3 have the same invariants C4 
and Cg. Then E has Weierstrass equation 



We compute a flex point on C3 with co-ordinates in a number field, 
L say. Typically [L : Q] = 9. Then Algorithm 6.3 finds a matrix 
g e GL3(L) with 

{Us o g)[z, X, y) = \{y^z - + 27c4xz'^ + bAc^z^) 

for some A e L^. (In the notation of §2 we have g = B^^.) 

Next we let ^2,3 '■ C2 — P(Mat2,3) be the embedding defined in 
Proposition 5.1(iv). The image is a genus one normal curve of degree 6. 
We use linear algebra to compute a basis Qi, . . . ,Qg for the space 
of quadrics vanishing on this curve. Writing these as polynomials in 
variables X^j for 1 < i < 2 and 1 < j < 3, we make the substitution 



The new quadrics have coefficients in L, but the vector space they span 
has a basis with coefficients in Q. We compute an LLL-reduced basis 
for the intersection of this space with 1j[xu, . . . , ,T23]. These are now the 
equations for a 6-covering Cq C P(Mat2,3). Moreover, by Theorem 2.5, 
the covering map Cq — > C3 is defined by the 2x2 minors, i.e. 



The details of 12-descent are similar. We start with a 3-covering 

C3 = {U3{xi,X2,X3) = 0} and a 4-covering C4 = {Qi = Q2 = 0}, each 
defined over Q, and with the same invariants C4 and Cg. We compute a 
flex point on C4 with co-ordinates in a number field, L say. Typically 
[L : Q] = 16. Then Algorithm 6.4 finds a matrix g e GL4(L) with 

{Qi ° g,Q2° g) = (2^1X4 — xl, X2X4 — x\ — 270^x1X2 — 54c6x^). 

Next we let (63 4 : C3 — > P(Mat3^4) be the embedding defined in 
Proposition 5.2(iv). The image is a genus one normal curve of de- 
gree 12. We use linear algebra to compute a basis Qi, ■ ■ ■ ,QbA for 
the space of quadrics vanishing on this curve. As in the case of 6- 
descent, we then twist by g G GL4(L) to obtain equations for a 12- 
covering C12 C P(Mat3,4). Moreover, by Theorem 2.5, the covering 
map C12 — > C4 is defined by the 3x3 minors. 



y"^ = — 27C4X — 5Acq. 





^ (a:i2a:;23-a;22a;i3 : 2^133^21 - 2^232^11 : a:;iia:;22 -2^212^12) ■ 
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Unlike the case of 6-descent, we can combine a 3-covering and a 4- 
covering to give a 12-covering in two essentially different ways. This is 
because each of C3 and C4 represents both a Sclmer group element and 
its inverse. It is important that we compute both 12-coverings, since in 
the case they are soluble, their rational points will cover ±P + 12E{Q) 
and ±5P + 12£'(Q) respectively. In practice the second 12-covering 
is obtained by switching the sign in the third column of the matrix 
defining 03 4. 

It remains to search for rational points on Cq and C12. We use 
the p-adic point searching method due independently to Elkies and 
Heath-Brown, as implemented by Watkins in the Magma function 
PointSearch. Descriptions may be found in [22] and [24, §2.9]. (Elkies' 
original paper [10] only considers real approximations.) The method 
first chooses an auxiliary prime p, whose size depends on the height 
bound set for the search. The points on the reduction of C mod p are 
then enumerated, and for each such point Pq a lattice method variant 
of Henscl's lemma is used to search for rational points on C with reduc- 
tion Pq. a variant of the method uses two primes. The method works 
particularly well for curves of high codimension as considered here. 

Finally, our search for points is significantly improved if we "min- 
imise" our equations for Cq and C12 before running PointSearch. We 
give details in §6.3. 

6.2. Computing flex matrices. Let [C P"~^] be a Brauer-Severi 
diagram. To compute a flex matrix for C, as defined in §2, we first 
find a fiex point P on C. We then follow an inductive procedure, based 
on the idea of projecting away from P. This method is a by-product 
of the standard procedures for putting an elliptic curve in Weierstrass 
form, as described in [3, §8]. We therefore simply list the algorithms 
used. Notice that we do not use the general Riemann-Roch machinery 
implemented in Magma, as this would be unnecessarily slow in our 
applications. 

Algorithm 6.2. Let U e k[xi,X2] be a non-singular binary quartic 
with invariants C4 and cq. Given (a : /3) G F^{k) with U{a,P) = we 
compute g e GL2(/c) with last column {a, (3)'^ satisfying 

{Uog){z,x) = ^{detgf{x^z-27c4XZ^-54:C6z'^). 

(1) Choose any gi G GL2(A;) with last column {a,j3)'^. 

(2) Compute {U o gi){z, x) — (det gi)'^{bx^z + cx^z^ -\- . . .) and put 




(3) Return gig2. 
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Algorithm 6.3. Let U G k[xi,X2,x^] be a non-singular ternary cubic 
with invariants C4 and Cq. Given (a : /3 : 7) e P^(A;) a flex point on 
the curve {U — 0} we compute g e GL3(A;) with last column (a, /3, 7)^ 
satisfying 

{U o g)[z,x,y) = ^{det g){y'^z - x^ + 27c4xz'^ + 54:Cgz^). 

(1) Choose any gi G GL3(A;) with last column (a,/?, 7)'^. 

(2) Write {U og^) {z, x,y) = {det gi){fi{z, x)y^ + f2iz, x)y + fsiz, x)) 
and let a,P E k with a;) — (3z — ax. Then run Algo- 
rithm 6.2 on |/| — /1/3 to obtain g G GL2(/c). 

(3) Compute p,q & k with 

(/i = (det^)^ 

{f2 9){z,x) = (det5f)(p2;-Fga;)2; 



and put g2 



6g 

-3p —3q 



(4) Return gig2- 

In the case n = 4 the invariants are again described in [1]. We label 
them C4 and cq, with scalings as specified in [11]. 

Algorithm 6.4. Let Qi,Q2 G X2, X3, X4] be a pair of quadrics, 
with invariants C4 and Cq. We suppose that {Qi = Q2 ~ 0} is a, smooth 
curve of genus one. Given {a : j3 : '~f : 6) E F'^{k), a flex point on this 
curve, wc compute g G GL4{k) with last column (a,/?, 7, 5)"^ satisfying 

{Qi ° g,Q2° g) = {xix^ — x\, X2X/^ — xl — 2704X1X2 — 54:CqxI). 

(1) Choose any gi G GL4(A;) with last column {a, (3,j,d)'^ . 

(2) Write 

QlOgi = hixi,X2,X3)x4 + qi{xi,X2,X3) 
Q2 0gi = i2{Xl,X2,X3)X4, + q2{Xi,X2,X3) 

and let 



a 



il2 
?22 



43 



^13 
43 



^21 



7 



4i 42 
4i 42 



where 4 = X] ^ij^j- Then run Algorithm 6.3 on (det gi)~^{i2Qi — 
£1^2) to obtain g G GL3(A;). 

(3) Replace Qi and (^2 by linear combinations (and update the 4 
and qi of Step 2) so that ii o g = Xi ioi i = 1, 2. 

(4) Compute a,b,c E k with 

^lOg- = |(a;i(aa;i 6x2 + CX3) - a;|) 

52° 5' = l{x2{axi + bx2 + CX3) — xj — 27C4X1X2 — McQxj) 
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and put g2 



\ 
6g 


y -a -b -c 1 J 

(5) Return gig2- 

6.3. Minimisation. If an n-covering tt : C — > is to be useful in the 
search for rational points on E, not only must we find explicit equations 
for C C P""^, but we must also find a change of co-ordinates on P""^ 
so that these equations have reasonably small coefficients. The task 
naturally falls into two parts which, following terminology introduced 
by Cremona, we call minimisation and reduction. 

Minimisation is the task of removing as many prime factors as possi- 
ble from a suitably defined discriminant. The most familiar example is 
that of minimising a Weierstrass equation. By reduction we mean the 
use of unimodular transformations to further decrease the size of the 
coefficients. The basic example is reduction of binary quadratic forms, 
or more generally lattice reduction. Thus minimisation is concerned 
with the finite places, and reduction with the infinite places. The need 
to perform reduction is our main reason for working over the rationals 
(instead of a more general number field). 

The minimisation and reduction of 2-coverings has been studied in 
[2], [4], and [8]. The generalisations to 3-coverings and 4-coverings are 
described in [6] and [24]. These algorithms have been implemented in 
Magma, and are called by the functions TwoDescent, ThreeDescent 
and FourDescent. Hence in §6.1 we start with an n-covering and an 
(n -|- l)-covering both of which are already minimised and reduced. 
So it would not be unreasonable to hope that the n(n + l)-covering 
computed from them will automatically be minimised and reduced. 
Numerical examples suggest that this is true for reduction, but not for 
minimisation. 

The following is a description of our current ad hoc approach to the 
minimisation of n-coverings for n > 5. Although this method works 
reasonably well in practice, there remains considerable room for both 
theoretical and practical improvements. 

Let C C P"~i be a genus one normal curve, defined over Q, and of de- 
gree n > 4. We recall that the homogeneous ideal I{C) in Q[xi, . . . , x^] 
is generated by a vector space of quadrics of dimension N = n(n — 3)/2. 
Then for A E GL^(Q) and B e GL„(Q) we define 

[A, B](qi,...,qN) = (EJIi o-iiQi o , . . . , Xlii amQi o B'^). 
Definition 6.5. (i) An integral model (gi, . . . , qn) for C is a tuple of 
quadrics in Z[a;i, . . . , Xn] generating /(C). 
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(ii) An integral model {qi, . . . , qn) is minimal at a prime p if whenever 
A e GLjv(Q) and B e GL„(Q) with [A, B]{qi, ...,qN) integral, then 

ordp(det A) + {n - 3) ordp(det B) > 0. 

(iii) An integral model is minimal if it is minimal at all primes p. 

It is not even clear from our definition that minimal models exist, 
although in the cases n = 4, 5 this can be proved using the invariants 
defined in [1] and [11]. The condition in Definition 6.5(ii) is motivated 
by considering what happens when A and B are scalar matrices. 

We attempt to minimise at p as follows. Let Ip be the ideal in 
Fp[a;i, . . . , Xn] generated by the reductions of qi, . . . , q^ mod p. Wc 
compute the Fp- vector space Vp of linear forms in the radical of Ip. 
By a unimodular change of co-ordinates we may suppose that Vp — 
{xi, . . . , Xd) for some < d < n. Then we put 



and compute the index of the lattice spanned by the qio B m its 
saturation in Z[a;i, . . . , x„]. We call the integer m — [n — 3)d the gain. 
If the gain is positive then we switch to the new quadrics and start over 
again. Otherwise we stick with the old quadrics. Sometimes it is worth 
trying other choices for the vector space Vp, for example the space of 
linear forms in one of the minimal primes containing Ip. There is no 
guarantee that these methods will produce a p-minimal model (and in 
general they do not) . 

The end result of our attempts at minimisation is a change of co- 
ordinates on P"^~^. We run the LLL algorithm on the rows (or columns 
depending on conventions) of the change of basis matrix, before apply- 
ing it to the original quadrics. This is to ensure that we do not throw 
away the fact our quadrics are already (close to being) reduced. 



7.1. An example of 6-descent. The following problem falls into the 
class of problems discussed on pages 480-481 of [9]. 

Given an integer N > 2, decide whether there are non- 
zero integers x and y such that both x'^ + Nxy + and 
— Nxy + y^ are squares. 

Elementary manipulations show that the problem is equivalent to de- 
ciding whether the elliptic curve 




7. Numerical Examples 



= x{x + (A^ + lf){x + (AT - 2f) 
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has positive rank^. MacLeod and Rathbun [14] have undertaken to find 
a solution for x and y (where one exists) for all N < 1000. The one 
case to elude them (as of November 2006) was N = 809, for which the 
rank is 1 and the generator is predicted^ to have height 617.88. On the 
2-isogenous curve 

E'j^: = + 2{N^ + 12iV + 4)^^ + (A^ - 2)*x 

the predicted height is half this value, yet still beyond the range that 
can be found using 4-descent. The conductor of ii^ = E'^^g is sufficiently 
large that a Heegner point calculation ran into difficulties (and for this 
reason the curve was reported to Magma as a bug). 

We find a point of infinite order on E using 6-descent. The existing 
Magma functions for 2-descent and 3-descent give us a 2-covering 

C2 = {y^ = 1385460;^ + 225978a;?a;2 + 435649a;^a;^ + 3884x10;^ + 183499a;^} 

and a 3-covering 

_ f 54x3 - 847/3 _ 258^3 + lUx^y + 87x'^z - 350xy^ 
3 - I + 7iy-^z - 1656a;22 - 986yz^ - 388xyz = 

To compute this 3-covering we had to find the class group and units 
for a number field of degree 8. This is by far the most time consuming 
part of the 6-descent calculation, taking a couple of hours, as compared 
to at most a couple of minutes for each of the other steps. 

Following the method described in §6.1 we compute 9 quadrics defin- 
ing a 6-covering Cq C P(Mat2,3). These are quadrics in 6 variables, la- 
belled Xij for 1 < i < 2 and 1 < j < 3. The coefficients are reasonably 
small integers, the largest in absolute value being 142. 

Minimising (at the primes 2, 3, 809 and 811), as described in §6.3, 
suggests making the substitution 







/ -70 


455 


293 


700 


-63 


437 \ 




/x,\ 


3^12 




104 


417 


-363 


290 


745 


-579 




X2 






-268 


-89 


205 


-60 


1223 


817 




X3 


3^21 




-320 


-335 


-839 


386 


147 


-311 




X4 


2:22 




-318 


411 


-123 


-696 


-405 


561 






\a;23/ 




\ 284 


59 


-523 


226 


-15 


1973/ 




\X6/ 



This decreases the size of the coefficients. More importantly, but as 
we will only see in hindsight, it also reduces the (naive) height of the 

^The trivial solutions correspond to a subgroup T C -Ejv(Q) with T = Z/2Z x 
Z/4Z. Since ±{N'^-A) ^ (Q*)^, the image of T under the 2-descent map EnIq) 
Q7(Q*)2 X Q*/(Q*)2 has order 4. It follows that EN{Q)tors = T. 

^This estimate comes from the Birch-Swinnerton-Dyer conjecture, assuming that 
the Tate-Shafarevich group is trivial. 



30 



TOM FISHER 



point we are looking for. The new quadrics are 



qi = X1X4 + 2x2X3 + 2x2X4, — 2x2X5 — 2x2Xe + — 2x3X4 — 6x3X6 — X4X5 + 4x4X6 
—2x\ + 5X6X6 + x§ 

q2 = X1X2 + X1X3 — 2x1X4 + 3X1X5 — 4X1X6 — x| + 2X2X6 — 7X2X6 + x| — X3X4 + 4X3X6 

— 2X3X6 + 5x| — 3X4X5 — 8x4X6 + Xg + 2X5X6 — 6Xg 

93 = x\ + X1X3 + 3x1x4 + 5x1X5 — 2xiX(i — 3x| + 5x2x3 + X2X4 — 4x2X6 — X2X6 + 2x3 

+4x3x4 + 7x3X5 — 5x-3X(i + 3x| — 5x4X6 — 2x5X6 — Xg 
q4 = Xj — 3x1X2 + 3.T1X-4 + .T1.T5 + 5xiX6 + 7x2x3 + 3x2x4 — 5x2x5 + 3x2X6 + 7xg 

—2x3X4 — X3X5 + 7x3Xfi — 5x| + X4X5 — x| — X5X6 
qs = 2x1X2 — X1X3 + X1X5 — 7xiX(i — x| — 6x2X3 — 2x2X4 + X2X5 — 8x2X6 — 2xg — 3x3X4 

—5x3x5 + 2x| + 3x4X6 + X? — 7x5X6 — Xg 
q6 = x1 + 3X1X2 + 5X1X3 — 3x1X4 — 2x1X5 + 2xiX6 + 2x| + 4X2X3 + X2X5 + 9X2X6 

— Xg + 2X3X4 + 4X3X5 + 9x| + 6X4X5 + 5X4X6 — Xg + 4Xg 

qj = xf + 2X1X2 + 3X1X3 — 3xiX4 + X1X6 — 6x| + 8x2X3 + 9X2X4 + X2X6 + 2X2X6 + 3x3 

+X3X4 + 7x3x5 — X3X6 — 6x4 — 2x4x5 — 6x4X6 + 3x| — X5X6 — Xg 
qs = Xj — 2x1X2 + X1X3 — 2x\X4 + 3x1x5 + 2xiX6 — X2X3 — X2X4 + 3x2x5 — 8x2X6 

— X3 + 7x3x4 + 8x3X5 + 12x3X6 + 4x| — 2x4x5 + 2x4X6 + 6x5X6 — 5xg 
q% = X1X2 — 6x1X3 + 6x1X4 — 2X1X5 + 6x1X6 — x| + X2X3 — 5X2X4 — 2X2X6 — 2X2X6 

—7X3 — 3x3X4 + 5x3X5 + X3X6 — 3x| + 10x4X5 + 5X4X6 — 4X5 + 5X6X6 + 2Xg. 

The PointSearch function (see §6.1 for references) finds a solution 

{xi : . . . : xe) = (7439932626 : -837815413 : -525136075 : 

2262805710 : -3465232629 : -1122238333). 



Mapping back to Ce this point becomes 

/ 42664889066 -110100049465 -1219600972219\ 
\-157741863480 -574453039469 114558712088 J 

The 2x2 minors are the co-ordinates of a point in C3(Q) which then 
maps down to a point P e E(Q) of canonical height 308.94. It is 
routine to check (using the bounds given in [7]) that P is a generator 
for the Mordell-Weil group modulo torsion. 

The final values of x and y for which both x^ + 809xy + y"^ and 
x^ — 809xy + y^ are squares may be found on the website [14] . They 
have 534 and 537 decimal digits respectively. 

7.2. An example of 12-descent. As described in the introduction, 

Mark Watkins provided me with a list of 35 elliptic curves over Q 
of analytic rank 2 for which only one generator of the Mordell-Weil 
group was known. The Birch-Swinnerton-Dycr conjecture gives an 
estimate for the height of the supposed second generator. The curves 
were ordered by this estimated height. For the first 30 curves on the 
list, the estimated height was in the range 220 up to 370. The last 5 
were as follows. We list the conductor Ne, the coefficients Oi, . . . , 
of a minimal Weierstrass equation, and the canonical heights of the 



Xii Xi2 Xi3 

X21 X22 X23 
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generators. (The last column was computed in hindsight.) 

Ne [01,02,03,04,^6] KPi) h{P2) 

8423178259 [0,-1,1,-6286122,-6064183289] 17.2636 442.070 

4817824003 [0,-1,1,-91969194,-339447383999] 15.4617 445.878 

4353186907 [1,1,0,-14176508,-20550712585] 14.4505 488.336 

5242805459 [1,1,0,-5078887,-4407675042] 2.9643 527.301 

7800899941 [0,0,1,-237882589,-1412186639384] 5.3208 642.626 

Each curve on the list is the only curve in its isogeny class, and so in 
particular has trivial torsion subgroup. According to Magma we have 
S^^\E/Q) = (Z/3Z)2 and S^^\E/Q) ^ (Z/4Z)2. Magma also returns 
4 ternary cubics and 6 pairs of quadrics, representing the inverse pairs of 
elements of order n in S^^-^E/Q) for n = 3, 4. Following the method de- 
scribed in §6.1 we compute 48 different 12-coverings, each correspond- 
ing to an inverse pair of elements of order 12 in S^^'^\E/Q) ^ {Z/12Zf. 
Since E{Q) has one generator of small height, we only needed to search 
on a few of these before a second independent generator was found. 

We give brief details for the last curve on the list. In this case the 
first generator is 

Pi = (-2003564/15^ -1691/15^). 

To compute a second independent generator we start with a 3-covering 

13x^ - S7y^ - U2z^ + llx^y + 2%x'^z + llxy'^ 

- 187y2^ - 35x^2 - 30yz2 - 118xy^ = 

and a 4-covering 

x\ -\- 3XiX2 + 13XiX4 — 2x\ — 2x2X2 

+ X2X^ — 6X3 — 9,T3,T4 -|- 7x| = 

Following the method described in §6.1 we compute 54 quadrics in 12 
variables defining a 12-covering C12 C P(Mat3,4). The coefficients are 
integers of absolute value at most 40. After minimising at the unique 
bad prime of E, the largest absolute value was 7. On this modified 
curve, PointSearch (see §6.1 for references) found a solution 

(-38935814 : 66676907 : 35419393 : -17989378 : 14587909 : -9597188 : 
-41856515 : -6994528 : -103052506 : 12269644 : 11697462 : 25846956) 

Mapping back to C12 this point becomes 

-585852746652 -134738830676 992806781984 -476555121265\ 
-5994121237 8026743882 -211970353911 286395682995 
303306392932 -167866472332 -273061778593 215669566507 / 



C4 



3x1 ~ 6x1X2 + 5x1X3 — 14x1X4 + 8x2 



— 7x2X3 — 2x2X4 + 5,X3 + 6x4 = 
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The 3x3 minors are the co-ordinates of a point in C4(Q) which then 
maps down to a point P — {r/t'^,s/t^) e -E'(Q) of canonical height 
651.86 where 

t = 19114217356093463705777747876066898415631548291608697\ 
40922807612824612875940389382477232533975065261036903\ 
1136244375962645684728831244647511 

r = 93385419996781 156236208893304670769704360761931620474\ 
91160376652094516256058095438975234936485365750728672\ 
93638862617394747880602761519393543195699455909538302\ 
59168129312401737073248837456279406678810951156628252\ 
40211217008647003170248465787238475381689553329226658\ 
862657964535534165 

s = 21189601910515224224247520792578674272370041362778083\ 
56705954773720391166818153294963600750782215820469113\ 
74353930791392149260850703573807892173379962268109766\ 
98439592570904852474980215470887488235939468315716611\ 
87491555874815362407229178054307290009804071221273367\ 
65774805454336495291566121830488793684956520543942634\ 
32595140366259647660234205784539280961702449802725098\ 
961125300545865563681315860704624955352014647220765212 

A second generator of shghtly smaller height is P2 = P + Pi with 
h{P2) = 642.63. (In hindsight we could find P2 directly by starting 
with different C3 and C4.) According to Magma the regulator of the 
subgroup generated by Pi and P2 is 3415.49, the non-zero value con- 
firming that these points are independent. Again it is routine to check 
(using the bounds given in [7]) that Pi and P2 generate the Mordell- 
Weil group. 
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